Network → DNS services (GET /api/v1/dns-services, administrators)
serves DNS over TLS (RFC 7858, port 853), over HTTPS (RFC 8484, path
/dns-query on the HTTPS port of the interface) and over QUIC (RFC 9250,
port 853 UDP), with the same answers, rules and clients (allowed ranges,
people, journal) as DNS on port 53. The queries are counted by protocol.
The phones only accept the certificate of a public authority for the name
they are given. PUT /api/v1/dns-services/certificate chooses how to get
it:
| Mode | Name | Certificate |
|---|---|---|
warda (recommended) |
given by the online service of Warda: <10 letters>.warda-dns.net |
Let's Encrypt, DNS-01 challenge written by the service (cloud) |
domain |
a name of the owner (dns.maison.example) |
Let's Encrypt, DNS-01 challenge written with a Cloudflare API token (Zone.DNS edit) or the keys of an OVH application (/domain/zone/*) |
self |
any name | made by Warda (ECDSA P-256, 2 years), signed by an authority of its own limited to that name, to trust on each device |
import |
the first name of the certificate that is not a wildcard (a wildcard alone is refused) | given with its key (PEM), renewed by its owner |
In self mode, Warda makes an authority for the name of the box, then the
server certificate it signs. That authority is what the Apple devices
install as a root, so it can only vouch for the name of the box: critical
name constraints allow that name (and its subdomains) alone and no IP
address, it cannot sign another authority (MaxPathLen 0), and its key is
discarded once the certificate is signed. A certificate made in self mode
by an older version (its own authority, for any name) is made again when
Warda starts: the profile must then be installed again on the Apple
devices. For 60 days the page of the DNS services and the state of the
services on the dashboard say so (remade in the certificate state and in
services.encrypted).
The certificate, its key, the key of the ACME account and the key of the
box at the online service are in tls/ of the data directory (owner only).
A new certificate and its key are first written together to
tls/dns.pending, then copied to dns.crt and dns.key: an install that a
stop interrupts is finished at the next start, so the key never goes
without its certificate.
The certificate is obtained in the background (the page follows it) and
renewed 30 days before its end (task certificate), or at once when a
certificate made by Warda stands where one of an authority is wanted (a
first try that failed); the keys of a DNS
provider are kept in the database and never shown again. Warda answers the
name itself with its own address: it is never published, and nothing of the
box but its key and its identifier goes to the online service.
The first certificate turns the three protocols on; PUT /api/v1/dns-services/protocols chooses them. A change restarts Warda (a few
seconds without names): DoT and DoQ are listened to, and DoH is served on
the HTTPS port, which gives the certificate of the encrypted DNS to the
clients that ask its name (SNI) and the certificate of the interface to the
others. GET /api/v1/dns-services/profile gives a profile for iPhone, iPad
and Mac (.mobileconfig, DNS over HTTPS, with the limited authority as a
root when the certificate is made by Warda). DNS over QUIC drops the
datagrams of the clients outside the allowed ranges before the handshake. Android takes the name in Private DNS,
Windows 11 the address of the box and the DoH template, the browsers the
DoH address. These addresses work on the network of the house only: an
Android phone keeps its private DNS everywhere, and outside it gets no
names at all with this one (the page and the guide say so).